From fee38633d2f81a1bc9c14093e017319b1cd6a2cf Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Tue, 26 Nov 2019 10:19:27 +0100 Subject: Fix #78840: imploding $GLOBALS crashes We add support for IS_INDIRECT zvals to implode(). --- NEWS | 1 + ext/standard/string.c | 4 ++-- ext/standard/tests/strings/bug78840.phpt | 10 ++++++++++ 3 files changed, 13 insertions(+), 2 deletions(-) create mode 100644 ext/standard/tests/strings/bug78840.phpt diff --git a/NEWS b/NEWS index 4f02519711..4c25151dc3 100644 --- a/NEWS +++ b/NEWS @@ -22,6 +22,7 @@ PHP NEWS - Standard: . Fixed bug #78759 (array_search in $GLOBALS). (Nikita) . Fixed bug #77638 (var_export'ing certain class instances segfaults). (cmb) + . Fixed bug #78840 (imploding $GLOBALS crashes). (cmb) 21 Nov 2019, PHP 7.3.12 diff --git a/ext/standard/string.c b/ext/standard/string.c index 0bb4d3a0a9..55c3f395d3 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -1216,14 +1216,14 @@ PHPAPI void php_implode(const zend_string *glue, zval *pieces, zval *return_valu RETURN_EMPTY_STRING(); } else if (numelems == 1) { /* loop to search the first not undefined element... */ - ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(pieces), tmp) { + ZEND_HASH_FOREACH_VAL_IND(Z_ARRVAL_P(pieces), tmp) { RETURN_STR(zval_get_string(tmp)); } ZEND_HASH_FOREACH_END(); } ptr = strings = do_alloca((sizeof(*strings)) * numelems, use_heap); - ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(pieces), tmp) { + ZEND_HASH_FOREACH_VAL_IND(Z_ARRVAL_P(pieces), tmp) { if (EXPECTED(Z_TYPE_P(tmp) == IS_STRING)) { ptr->str = Z_STR_P(tmp); len += ZSTR_LEN(ptr->str); diff --git a/ext/standard/tests/strings/bug78840.phpt b/ext/standard/tests/strings/bug78840.phpt new file mode 100644 index 0000000000..b9e1a84a76 --- /dev/null +++ b/ext/standard/tests/strings/bug78840.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #78840 (imploding $GLOBALS crashes) +--FILE-- + +--EXPECT-- +done -- cgit v1.2.1